interesting Ms Mittens... what version of Ethreal and what OS was being used? I have used Ethreal to good ends tracking spoofed IPs here at work, and the same with tcpdump too.